Physiologic tourniquet with safety circuit

ABSTRACT

A configuration register is incorporated into an electrically powered tourniquet apparatus for enabling an operator to change the values of parameters initially employed at the time of the next use of the apparatus, such as the initial pressure settings and elapsed time limits. These changed initial values of parameters are stored in memory and remain there despite inadvertent or intentional interruption of electrical power to the apparatus. An event register provides capability for recording the occurrence of events (cuff inflation, cuff deflation, etc.) and for relating the occurrence of the events to hazards and undesirable outcomes such as nerve damage associated with tourniquet usage. A safety circuit is included to detect and respond safely to certain failures which are possible within the tourniquet apparatus.

FIELD OF THE INVENTION

This invention pertains to physiologic tourniquets for use in surgery.In particular, the invention pertains to an electrically poweredtourniquet having a configuration register for optimizing, customizing,simplifying, and reducing the time required for configuring tourniquetpressure settings, elapsed time limits and other parameters oftourniquet operation. The invention also pertains to a physiologictourniquet having an event register for registering predetermined eventsduring surgery concerning the application of pressure to a limb foroccluding blood flow and for maintaining intravenous regionalanesthesia, in order to help improve patient outcomes and reducerecurrences of tourniquet-related events associated with injuries topatients.

BACKGROUND OF THE INVENTION

This invention pertains to tourniquets for facilitating surgicalprocedures performed on upper and lower limbs. Surgical tourniquets aregenerally employed to establish a bloodless operative field in a limbdistal to an encircling cuff by regulating a pressure applied to thelimb by the cuff near a pressure sufficient to stop arterial blood flowpast the cuff during the surgical procedure. Surgical tourniquets of theprior art typically include an inflatable cuff for encircling a limb, anautomatic pressure regulator for inflating the cuff to maintain apressure applied by the cuff to the limb near a reference pressureselected by an operator or determined automatically, an elapsed timeindicator to indicate the duration of application of pressure to thelimb and an operator interface to facilitate operator control andinteraction. A typical pneumatic tourniquet of the prior art isdisclosed by McEwen in U.S. Pat. No. 4,469,099.

A "physiologic tourniquet" is generally considered to be a tourniquetwhich has the capability of maintaining the pressure applied by the cuffto the limb near the minimum pressure required to stop the flow ofarterial blood past the cuff during the surgical procedure. This minimumpressure is affected by variables related to the physiology of thesurgical patient, the type of surgical procedure to be performed and itslikely duration, the type of cuff employed and its location and snugnesson the limb, the technique employed by the surgeon and the anesthetist,and other factors. Tourniquet apparatus useful in automaticallyestimating and employing such a minimum pressure is disclosed by McEwenin U.S. Pat. No. 4,479,494, in U.S. Pat. No. 4,770,175 and in a pendingU.S. Divisional patent application having Ser. No. 08/128,478 filed onSep. 28, 1993.

Surgical tourniquets are typically employed as follows. A suitableinflatable cuff is first selected by an operator and applied snugly tothe limb on which surgery is to be performed so that the cuff is locatedbetween the heart and the operative site on the limb. Considerationsinvolving the design, selection and application of cuffs have beendescribed by McEwen, for example in U.S. Pat. No. 4,605,010, in U.S.Pat. No. 5,181,522 and in U.S. Pat. No. 5,312,431. After application ofa suitable cuff, the portion of the limb distal to the cuff is thenexsanguinated, often by wrapping the limb with an elastic bandage,beginning at the end of the limb and wrapping tightly towards the heartup to the cuff location. While the limb is thus exsanguinated, thetourniquet instrument is typically used to inflate the cuff and maintainit at a predetermined cuff pressure sufficient to stop the inflow ofarterial blood past the cuff. The elastic bandage is then removed andsurgery proceeds. The pressure applied by the cuff may be changedperiodically or continuously during the surgical procedure in an effortto maintain a bloodless surgical site while employing the minimum cuffpressure required to do so, as explained more fully below. Uponcompletion of the surgical procedure, the cuff is depressurized andremoved from the patient, allowing arterial blood to flow freely intothe limb.

During certain surgical procedures performed under intravenous regionalanesthesia (IVRA), the surgical tourniquet system serves an additionalrole of preventing liquid anesthetic agent introduced into the veins inthe limb distal to the cuff from flowing proximally past the cuff andout of the limb into the circulatory system. For surgical procedureswhere IVRA is to be employed, special cuffs having dual bladders ofnarrower widths are often used for encircling the limb, resulting in afirst bladder encircling the limb above a second bladder which alsoencircles the same limb distal to the first bladder. Alternatively, twoseparate single-bladder cuffs of greater widths can be applied to thesame limb. To maintain the pressures applied by one dual-bladder cuff ortwo single-bladder cuffs near selected reference pressures, onetourniquet instrument having a dual-channel automatic pressure regulatormay be employed, or two separate tourniquet instruments, each having oneautomatic pressure regulator, may be employed. Prior art tourniquetapparatus for intravenous regional anesthesia is described by McEwen inU.S. Pat. No. 5,254,087.

Before the commencement of a surgical procedure, an operator typicallyconfigures a pneumatic tourniquet of the prior art as follows. Upon theinitial supply of electrical power to a tourniquet of the prior arthaving one or two pneumatic channels, the levels of cuff referencepressures and time limits for elapsed time indicators and alarms areautomatically set to standard, arbitrary default levels set by themanufacturer. The operator may then employ controls and displays formingpart of the operator interface to change the configuration of the cuffreference pressures and the time limits to levels appropriate for thepatient's physiology, the type of surgical procedure to be performed andits probable duration, the type of cuff employed and its snugness ofapplication, and the technique to be employed by the surgeon andanesthetist. Often such changes to the configuration are not made,because an operator does not have sufficient time available to do so, orbecause an operator has not been trained in how to make the changes, orbecause an operator has not been trained concerning what levels to seton the basis of the variables listed above. If such changes to theconfiguration are not made by an operator, then the performance of thetourniquet will be sub-optimal. Excessively high or low referencepressures will result in either a higher probability of nerve injury inthe limb encircled by the cuff or leakage of blood and in some casesliquid anesthetic agent. Also, a sub-optimal time limit either willresult in a significant reduction or elimination of the utility ofwarning the surgeon of an excessive period of cuff pressurization for aparticular procedure surgical value of elapsed time alarms in reducingtourniquet time if the time limit setting is excessively high, or willresult in an annoyance and distraction to surgical and anesthesia staffif the time limit setting is too low.

Even if an electrically powered pneumatic tourniquet of the prior arthas been configured by an operator to have levels of reference pressuresand time limits which are more appropriate than the arbitrary defaultlevels set when electrical power is first supplied, such configuredlevels are not retained upon the inadvertent or intentional interruptionof electrical power to such prior art tourniquets. Upon the resumptionof electrical power to such prior art tourniquets, the referencepressures and time limits are again set to the same arbitrary andsub-optimal default levels.

The applicant is unaware of any electrically powered surgical tourniquetin the prior art having the capability of optimizing, customizing,simplifying, and reducing the time required for, the configuration ofthe tourniquet on the basis of patient physiology, type of surgicalprocedure, type of cuff employed and operator technique, so thatparameters such as the reference pressure levels and the levels ofelapsed time limits can be set to near-optimum levels eitherautomatically or by an operator, retained during an inadvertent orintentional interruption of electrical power to the tourniquet, andreproduced as the initial configuration parameter levels upon aresumption of the supply of electrical power to the tourniquet.

Regardless of how parameters such as the reference pressures and timelimits are initially configured in a surgical tourniquet, a large numberof different events occurring during a surgical procedure and associatedwith tourniquet usage affect patient safety, the quality of thebloodless surgical field distal to the tourniquet cuff, and longer-termpatient outcomes. For example, as mentioned above, it is recognized thatthe level, distribution, and duration of pressure applied by the cuff tothe limb will affect the nature and extent of injuries associated withtourniquet usage. It is now generally known that every usage of asurgical tourniquet results in some patient injury, and it is thoughtthat the nature and extent of such injury can be minimized by improvedsetting, regulation and monitoring of the level, distribution andduration of the pressure applied by the tourniquet, by promptlyidentifying and responding to potentially hazardous events involvingtourniquet usage, and by post-operatively relating incidents, hazardsand undesirable outcomes such as nerve damage or paralysis, muscleweakness and soft tissue damage to pertinent intra-operative eventsassociated with tourniquet usage.

These events associated with the use of a tourniquet include: eachchange in the level of the reference pressure employed by the pressureregulator of a tourniquet over the duration of tourniquet usage; anysignificant differences between the pressure applied by the cuff and thereference pressure; any applied pressures which exceed, or which areless than, predetermined upper or lower pressure limits respectively;and the application of pressure for a time period greater than apredetermined limit. Events may be further defined to include the levelof the reference pressure or the level of the actual pressure applied bythe cuff at periodic intervals throughout tourniquet usage, so that thequality of the bloodless surgical field and any hazards, injuries andundesirable patient outcomes can be related to the completepressure-time set of events. In surgical procedures where IVRA isemployed, additional events occur which are associated with tourniquetusage and which affect patient safety, the quality of the intravenousregional anesthesia, and patient outcomes. These IVRA-related eventsinclude the sequence, timing and duration of pressurization anddepressurization of the bladders of a dual-bladder cuff or dual cuffs atvarious times during the surgical procedure, for reasons specificallyrelated to the IVRA technique.

Typically in the prior art, some of such predetermined events are notedby surgical or anesthesia staff and are recorded manually in surgical oranesthesia records. For example, many operators record total tourniquettime and the initial reference pressure level. However, such manualrecording of events is incomplete and inconsistent within institutions,among institutions, and even among individuals in the same operatingroom. Also, the recording of significant events may be delayed or not bedone at all, as the surgical staff may be attending to the patient as aresult of the occurrence of such significant events.

The applicant is not aware of any electrically powered tourniquet havingthe capability of registering the occurrence during limb surgery of anyone of a number of such predetermined events concerning the applicationof pressure to the limb for occluding blood flow and maintaining IVRA,so that the registered events are retained during an inadvertent orintentional interruption of electrical power to the tourniquet, and sothat the registered events can be displayed for an operator orreproduced on demand, after the restoration of electrical power.

In the prior art, some electrically powered tourniquets have employedpressure regulators which incorporate electro-pneumatic valves. Some ofthese prior-art tourniquets, such as the ATS 1500 Automatic TourniquetSystem manufactured by Zimmer Inc. of Dover Ohio, use one valve forinflation and one valve for deflation of each cuff and incorporate asafety circuit for detecting and responding safely to a limited range ofabnormal and hazardous actuations of the valves. However, the applicantis not aware of any tourniquet in the prior art which has multipleinflation valves and multiple deflation valves and which also has asafety circuit for detecting and responding safely to a wide range ofvalve related hazards including certain non-actuations of the valves,failure of one of the multiple inflation or deflation valves, orabnormal or undesired actuations of combinations of valves.

SUMMARY OF THE INVENTION

The present invention is to provide electrically powered tourniquetapparatus having improved speed and simplicity of configuration prior toinitial use, or following an inadvertent or intentional interruption ofelectrical power, by incorporating a configuration register whichconfigures the initial pressure setting of the pressure regulator to bea pressure previously selected by an operator or previously determinedautomatically. Also provided is an electrically powered tourniquetapparatus incorporating a configuration register which configures theinitial setting of an elapsed time limit to be a time limit previouslyselected by an operator or previously determined automatically.

Also provided is a physiologic tourniquet apparatus having an eventregister which provides capability for relating, eitherintra-operatively or post-operatively, the occurrence of incidents,hazards and undesirable outcomes such as nerve damage or paralysis,muscle weakness, soft tissue damage, and IVRA-related problems, topertinent intra-operative events associated with tourniquet usage. Theevent register records the occurrence during limb surgery of any one ofa number of events concerning the application of pressure to the limbfor occluding blood flow, and in some instances for maintainingintravenous regional anesthesia, so that the recorded events areretained during any inadvertent or intentional interruption ofelectrical power to the tourniquet, and so that the recorded events canbe displayed for an operator or reproduced on demand, including at anytime after the restoration of electrical power if it has beeninterrupted.

Also provided is an electrically powered tourniquet apparatusincorporating a safety circuit which will detect and respond safely toundesired valve actuations during different modes of operation of thepressure regulator.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a pictorial representation of the preferred embodiment in asurgical application.

FIG. 2 is a block diagram of the preferred embodiment.

FIGS. 3a, 3b, 3c and 3d are pictorial representations of the layout ofthe display panel of the preferred embodiment in different clinicalapplications.

FIGS. 4, 5, 6, 7, 8 and 9 are software flow charts depicting the controlsoftware of the preferred embodiment.

FIG. 10 is a block diagram of a valve assembly of the preferredembodiment.

DESCRIPTION OF THE PREFERRED EMBODIMENT

The embodiment illustrated is not intended to be exhaustive or limit theinvention to the precise form disclosed. It is chosen and described inorder to explain the principles of the invention and its application andpractical use, and thereby enable others skilled in the art to utilizethe invention. The preferred embodiment of the invention is described inthree sections below: hardware; operation and software.

I. Hardware

FIG. 1 depicts instrument 2 connected to pressurizing cuff 4 andpressurizing cuff 6, which cuffs can be inflated to apply pressures topatient limb 8. In FIG. 1, photoplethysmographic blood flow sensor 10 isshown applied to a digit of limb 8 distal to cuff 4 and cuff 6, andconnected to instrument 2. For clarity, cuff 4 and cuff 6 have beenshown as separate cuffs applied to the same limb 8, but in practice theseparate cuffs may be applied to different limbs of a patient, or theymay be combined as separate bladders of one dual-bladder inflatable cuffapplied to a single limb of a patient, depending upon the surgicalprocedure being performed and the type of anesthesia employed. In manytypes of surgical procedures, only cuff 4 is employed and cuff 6 is notused.

As can be seen in FIG. 1, cuff 4 is connected pneumatically by tubing 12and tubing 14 to instrument 2. Cuff 6 is connected pneumatically bytubing 16 and tubing 18 to instrument 2.

Electroluminescent graphic display panel 20 (EL4737LP, Planar Systems,Beaverton, Oreg.) shown in FIGS. 1 and 2 forms part of instrument 2 andis used to display information to the user of instrument 2. Displaypanel 20 is employed for the selective presentation of any of thefollowing information as described below: (a) menus of commands forcontrolling instrument 2, from which a user may make selections; (b)parameters having values which characterize the actual cuff pressures,cuff inflation times, cuff pressure reference levels and inflation timealarm limit values; (c) text messages describing current alarmconditions, when alarm conditions are determined by instrument 2; (d)graphical representations of blood flow signals produced by sensor 10;and (e) messages which provide operating information to the user.

Switch 22 (61-01032-10 Grayhill Inc., La Grange, Ill.) shown in FIGS. 1and 2, provides a versatile means for the user to control instrument 2.Switch 22 is a rotary selector and push-button combination switch. Incombination with the electronic circuitry and software described below,switch 22 operates by producing signals in response to rotation of theselector and activation of the push-button by the user. In the preferredembodiment, rotating switch 22 allows the user to select a specific menucommand or parameter for adjustment from those shown on display panel20. The currently selected menu command or parameter is "highlighted" bybeing displayed in reverse video. If a menu command is "highlighted",pushing then releasing switch 22 causes the action indicated by the menucommand to be performed. If a parameter is "highlighted", the value ofthe parameter can then be adjusted by pushing and releasing switch 22,and then rotating switch 22: clockwise rotation will cause the value ofthe parameter to be increased; counter-clockwise rotation will cause thevalue of the parameter to be decreased; pushing and releasing the switch22 again completes the adjustment of the parameter, and allows othermenu commands or parameters to be selected in response to subsequentrotation of switch 22.

As can be seen in FIG. 2, cuff 4 is connected pneumatically by tubing 12to pressure transducer 24, and is connected pneumatically by tubing 14to valve assembly 26. Valve assembly 26 is shown in detail in FIG. 10and further described below. Valve assembly 26 responds to certainsignals generated by microprocessor 28 (80C196KB, INTEL Corp., SantaClara, Calif.) to pneumatically connect tubing 14 through tubing 32 togas pressure reservoir 34, a sealed pneumatic chamber having a fixedvolume of 500 ml. Valve assembly 26 also responds to other signalsgenerated by microprocessor 28 to pneumatically connect tubing 14 toatmosphere, allowing the release of pressure in cuff 4. Valve sensingcircuit 1020 (FIG. 10) included in valve assembly 26 responds to a cuff4 mode signal generated by microprocessor 28 which is indicative of apredefined cuff mode; in the preferred embodiment three cuff modes forcuff 4 are defined: "cuff inflating" mode, "cuff regulating" mode and"cuff deflating" mode. The level to which the cuff 4 mode signal is setby microprocessor 28 is determined by user input and microprocessor 28.Pressure transducer 24 generates a cuff 4 pressure signal whichindicates the pressure of gas in cuff 4, and the cuff 4 pressure signalis then communicated to an analog to digital converter (ADC) input ofmicroprocessor 28 which digitizes the cuff 4 pressure signal. When thecuff 4 mode signal is at a level indicative of "cuff inflating" mode,microprocessor 28 acts to increase the level of pressure within cuff 4from a level near atmospheric pressure to a level near the referencepressure represented by the cuff 4 reference pressure signal, bygenerating signals for the actuation of valves 1002 and 1004 (FIG. 10)within valve assembly 26, thereby pneumatically connecting cuff 4 to agas pressure reservoir 34. When the cuff 4 mode signal is at a levelindicative of "cuff regulating" mode microprocessor 28 acts to regulatethe pressure within cuff 4 near the reference pressure represented bythe cuff 4 reference pressure signal by generating signals for theselective actuation of either valves 1002 or 1006 within valve assembly26, thereby pneumatically connecting cuff 4 to gas pressure reservoir 34or pneumatically conecting cuff 4 to atmosphere. When the cuff 4 modesignal is at a level indicative of "cuff deflating" mode, microprocessor28 acts to reduce the level of pressure within cuff 4 to a level nearatmospheric pressure by generating signals for the actuation of valves1006 and 1010 within valve assembly 26, thereby pneumatically connectingcuff 4 to atmosphere. To alert the user if the pressure in cuff 4 cannot be regulated within a pre-assigned limit of ±15 mmHg, microprocessor28 compares the cuff pressure signal from cuff pressure transducer 24 tothe reference pressure signal for cuff 4: if the cuff pressure signalexceeds the reference signal by 15 mmHg or more, microprocessor 28generates an alarm signal indicating over-pressurization of cuff 4. Ifthe cuff pressure signal is less than the reference pressure signal by adifference of 15 mmHg or more, microprocessor 28 generates an alarmsignal indicating under-pressurization of cuff 4. Microprocessor 28 alsotracks the inflation time for cuff 4, by maintaining a counterindicating the length of time that cuff 4 has been pressurized.Microprocessor 28 compares this actual cuff inflation time to aninflation time limit for cuff 4, and if the actual cuff inflation timeexceeds the inflation time limit, microprocessor 28 generates an alarmsignal indicating that the inflation time limit for cuff 4 has beenexceeded.

As depicted in FIG. 2, if cuff 6 is required for the surgicalapplication, cuff 6 is connected pneumatically by tubing 16 to pressuretransducer 36, and is connected pneumatically by tubing 18 to valveassembly 38. Valve assembly 38 has the same structure as valve assembly26 which is described in detail below and which is shown in FIG. 10.Valve assembly 38 responds to signals described below which aregenerated by microprocessor 28, to pneumatically connect tubing 18through tubing 32 to gas pressure reservoir 34. Valve assembly 38 alsoresponds to other signals described below which are generated bymicroprocessor 28 to pneumatically connect tubing 18 to atmosphere,allowing the release of pressure in cuff 6. Valve assembly 38 respondsto a cuff 6 mode signal generated by microprocessor 28 which isindicative of a predefined cuff mode; in the preferred embodiment threemodes for cuff 6 are predefined: "cuff inflating" mode, "cuffregulating" mode, and "cuff deflating" mode. The level to which the cuff6 mode signal is set by microprocessor 28 is determined by user inputand microprocessor 28. Pressure transducer 36 generates a cuff 6pressure signal which indicates the pressure of gas in cuff 6, and thecuff 6 pressure signal is then communicated to an analog to digitalconverter (ADC) input of microprocessor 28 which digitizes the cuff 6pressure signal. When the cuff 6 mode signal is at a level indicative of"cuff inflating" mode, microprocessor 28 acts to increase the level ofpressure within cuff 6 from a level near atmospheric pressure to a levelnear the reference pressure represented by the cuff 6 reference pressuresignal, by generating signals for the actuation of selected valveswithin valve assembly 38. When the cuff 6 mode signal is at a levelindicative of "cuff regulating" mode microprocessor 28 acts to regulatethe pressure within cuff 6 near the reference pressure represented bythe cuff 6 reference pressure signal by generating signals for theactuation of selected valves within valve assembly 38. When the cuff 6mode signal is at a level indicative of "cuff deflating" mode,microprocessor 28 acts to reduce the level of pressure within cuff 6 toa level near atmospheric pressure by generating signals for theactuation of selected valves within valve assembly 38. To alert the userif the pressure in cuff 6 can not be regulated within a pre-assignedlimit of ±15 mmHg, microprocessor 28 compares the cuff pressure signalfrom cuff pressure transducer 36 to the reference pressure signal forcuff 6: if the cuff pressure signal exceeds the reference signal by 15mmHg or more, microprocessor 28 generates an alarm signal indicatingover-pressurization of cuff 6. If the cuff pressure signal is less thanthe reference pressure signal by a difference of 15 mmHg or more,microprocessor 28 generates an alarm signal indicatingunder-pressurization of cuff 6. Microprocessor 28 also tracks theinflation time for cuff 6, by maintaining a counter indicating thelength of time that cuff 6 has been pressurized. Microprocessor 28compares this actual cuff inflation time to an inflation time limit forcuff 6, and if the actual cuff inflation time exceeds the inflation timelimit, microprocessor 28 generates an alarm signal indicating that theinflation time limit for cuff 6 has been exceeded.

As shown in FIG. 2, pneumatic pump 40 (E series 801105, GilianInstrument Corp. Caldwell, N.J.) is pneumatically connected to reservoir34 by tubing 42. Pump 40 acts to pressurize reservoir 34 in response tocontrol signals from microprocessor 28 communicated through pump driver44. Reservoir pressure transducer 46 is pneumatically connected throughtubing 48 to reservoir 34 and generates a reservoir pressure signalindicative of the pressure in reservoir 34. The reservoir pressuresignal is communicated to an ADC input of microprocessor 28. In responseto this reservoir pressure signal and a reservoir pressure referencesignal provided as described below, microprocessor 28 generates controlsignals for pump driver 44 and regulates the pressure in reservoir 34 toa pressure near the reference pressure represented by the reservoirreference pressure signal as described below.

Photoplethysmographic blood flow sensor 10 is placed on a portion of alimb distal to cuff 4, and distal to cuff 6 if cuff 6 is also employed,to sense blood flow beneath the flow sensor 10. FIG. 1 illustrates atypical location of sensor 10 for the lower limb. Sensor 10 generates ablood flow signal indicative of blood flow beneath the sensor, which isprocessed by amplifier 50 and communicated to an ADC input ofmicroprocessor 28, as depicted in FIG. 2.

Real time clock 52 shown in FIG. 2 maintains the current time and date,and includes a battery as an alternate power source such that clockoperation continues during any interruption in the supply of electricalpower from power supply 54 required for the normal operation ofinstrument 2. Microprocessor 28 communicates with real time clock 52 forboth reading and setting the current time and date.

Configuration register 56 shown in FIG. 2 is comprised of non-volatilememory (24LC02, Microchip Technology, Chandler Ariz.) operating inconjunction with microprocessor 28 as described below to containpreviously recorded cuff reference pressure levels and inflation timealarm limits for use by microprocessor 28 as described below, andretains these recorded levels of these parameters indefinitely in theabsence or interruption of electrical power from power supply 54required for the normal operation of instrument 2. The levels of thecuff reference pressures and inflation time limits initially recorded inconfiguration register 56 are given in the table below:

    __________________________________________________________________________             Cuff 4 reference                     Cuff 4 inflation                            Cuff 6 reference                                    Cuff 6 inflation    Operating Mode             pressure                     time limit                            pressure                                    time limit    __________________________________________________________________________    Single Cuff Mode             200 mmHg                     60 Min.                            --      --    Dual Cuff Mode             200 mmHg                     60 Min.                            200 mmHg                                    60 Min.    IVRA Dual Bladder             250 mmHg                     45 Min 250 mmHg                                    45 Min.    Cuff Mode    __________________________________________________________________________

Microprocessor 28 communicates with configuration register 56 to recordand retrieve levels of the configuration parameters recorded inconfiguration register 56 as described below.

Event register 58 shown in FIG. 2, records "events" which are defined inthe software of the preferred embodiment to be: (a) actions by the userto inflate a cuff, deflate a cuff, adjust the level of a cuff referencepressure signal, adjust the level of cuff inflation time limit signal,adjust the level of the operating mode signal or silence an audio alarm;(b) alarm events, resulting from microprocessor 28 generating an alarmsignal as described above; and (c) events associated with determining acuff pressure automatically as described below. Event register 58comprises event register memory 60 (28C64A Microchip Technology,Chandler, Ariz.), and event register printer 62. Microprocessor 28communicates with event register 58 to record events as they occur.Microprocessor 28 records an event by communicating to event register58: the time of the event as read from real time clock 52; a valueidentifying which one of a specified set of events occurred asdetermined by microprocessor 28; and the values at the time of the eventof the following parameters: operating mode signal, cuff 4 pressuresignal; cuff 4 pressure reference signal; cuff 4 inflation time, cuff 4inflation time limit; cuff 6 pressure signal; cuff 6 pressure referencesignal; cuff 6 inflation time, cuff 6 inflation time limit; andrecommended cuff pressure, when the event occurred. Entries are recordedin event register 58 by storing values in event register memory 60 andby printing these values for the user by means of event register printer62. Event register memory 60 retains information indefinitely in theabsence or interruption of electrical power from power supply 54required for the normal operation of instrument 2.

Microprocessor 28 communicates with electroluminescent display panel 20through display controller 64 to display information as described above.

User input is by means of switch 22. Signals from switch 22 arising fromrotation and push-button contact closure in switch 22 are communicatedto microprocessor 28.

Microprocessor 28 will, in response to generated alarm signals alert theuser by text and graphic messages shown on display panel 20 and by audiotones. Electrical signals having different frequencies to specifydifferent alarm signals and conditions are produced by microprocessor28, amplified by audio amplifier 66 and converted to audible sound byloud speaker 68 shown in FIG. 2.

Power supply 54 provides regulated DC power for the normal operation ofall electronic and electrical components.

Shown in FIG. 10 and described below is a detailed block diagram ofvalve assembly 26 shown in FIG. 2. When actuated, valve 1002 (EVO-3-60 VClippard Instrument Laboratory, Cincinnati, Ohio) pneumatically connectstubing 32 to tubing 14, permitting the flow of gas from reservoir 34shown in FIG. 2 to cuff 4. Valve 1004 (201A3/30F Burkert ContromaticCorp., Orange, Calif.) when actuated also pneumatically connects tubing32 to 14. The valve orifice of valve 1004 is substantially larger thanthe valve orifice of valve 1002 and therefore permits gas to flow intocuff 4 at a greater rate than valve 1002. Valve 1006 (EVO-3-60V ClippardInstrument Laboratory, Cincinnati, Ohio) when actuated pneumaticallyconnects tubing 14 to tubing 1008. Tubing 1008 is open to atmosphere andpermits gas to be released from cuff 4. Valve 1010 (201A3/30F BurkertContromatic Corp., Orange, Calif.) when actuated also pneumaticallyconnects tubing 14 to tubing 1008. The valve orifice of valve 1010 issubstantially larger than the valve orifice of valve 1006 and thereforepermits gas to be released from cuff 4 at a greater rate than valve1006. This combination of valves permits cuff 4 to be inflated anddeflated rapidly through valves 1004, 1010, and also permits thepressure in cuff 4 to be regulated accurately when inflated throughvalves 1002, 1006. Valve drivers 1012, 1014, 1016 and 1018, under thecontrol of signals from microprocessor 28, complete an electricalcircuit allowing electrical power to be applied for the actuation ofvalves 1002, 1004, 1006 and 1010 respectively.

Valve sensing circuit 1020 in valve assembly 26 monitors the actuationof valves 1002, 1004, 1006 and 1010 by monitoring the voltage levelsbetween the valve drivers and the valves. If any one of thepredetermined set of undesired valve actuations described below isdetected, valve sensing circuit 1020 responds by generating a "fault"signal that is sent to microprocessor 28. Valve circuit 1020 alsoresponds by disconnecting the supply of electrical power to all valves1002, 1004, 1006, and 1010, thus de-actuating valves 1002, 1004, 1006and 1010. De-actuating valves 1002, 1004, 1006 and 1010, ensures thatthe pressure within cuff 4 will remain stable and will not increase ordecrease to unsafe levels as the result of an undesired valve actuation.Microprocessor 28 responds to the "fault" signal by generating an alarmsignal indicating that a valve related fault has occurred. Undesiredvalve actuations may result from the failure of any one of valve drivers1012, 1014, 1016 or 1018, or failure of any one of valves 1002, 1004,1006 and 1010, or a failure in microprocessor 28, or a software error.The table below summarizes the undesired combinations of valveactuations which are detected by valve sensing circuit 1020 for thethree valid levels of the cuff mode signal.

    ______________________________________    CUFF MODE    SIGNAL   Valve 1002                       Valve 1004                                 Valve 1006                                         Valve 1010    ______________________________________    Cuff Deflating             actuated  x         x       x    Mode    Cuff Deflating             x         actuated  x       x    Mode    Cuff Deflating             x         x         de-actuated                                         de-actuated    Mode    Cuff Inflating             x         x         actuated                                         x    Mode    Cuff Inflating             x         x         x       actuated    Mode    Cuff Inflating             de-actuated                       de-actuated                                 x       x    Mode    Cuff Regulat-             actuated  x         actuated                                         x    ing Mode    Cuff Regulat-             x         actuated  x       x    ing Mode    Cuff Regulat-             x         x         x       actuated    ing Mode    ______________________________________     x = either actuated or deactuated

In the preferred embodiment, valve sensing circuit 1020 depicted in FIG.10 also responds to a cuff mode signal generated by microprocessor 28.In the preferred embodiment, the level of the cuff mode signal for cuff4 corresponds to one of three predefined levels, each of which isindicative of one of three modes: "cuff inflating" mode, "cuffregulating" mode and "cuff deflating mode". The cuff regulating moderefers to a mode of operation in which the cuff is maintained at apreselected pressure by the system. The level of the cuff mode signaldetermines which combinations of valve actuations will be classified asundesired by the valve sensing circuit 1020. Upon detecting an undesiredvalve combination, or upon detecting a cuff mode signal having a levelother than one of three predefined levels indicative of the three validcuff modes, valve sensing circuit 1020 generates a "fault" signal anddisconnects the electrical power supplied to valves 1002, 1004, 1006 and1010, thereby de-actuating valves 1002, 1004, 1006 and 1010. Deactuationof these valves maintains the prior status of the system, and reducesthe likelihood of occurences of such undesired events as simultaneousinflation and deflation of a cuff. An invalid cuff mode signal mayresult from the failure of microprocessor 28 or a software error.

II. Operation

At start-up of instrument 2, when instrument 2 is activated by supply ofelectrical power through power supply 54 microprocessor 28 configuresinstrument 2 by setting predetermined parameters to the levels recordedin configuration register 56. Configuration register 56 contains apreviously recorded level for the operating mode signal and, for each ofthe three possible levels of the operating mode signal, previouslyrecorded level for the cuff reference pressure and cuff inflation timealarm limit for each cuff, as described elsewhere. The user ofinstrument 2 can alter a level of a parameter recorded in configurationregister 56, by selecting the parameter and changing its level asdescribed below.

In operation, a user of the preferred embodiment communicates withinstrument 2 by using switch 22 to choose commands for controllinginstrument 2 from menus of commands, and by using switch 22 to set thelevel of parameters displayed on display panel 20, as described aboveand in the software description below.

Three distinct modes of operation of the preferred embodiment areprovided in the preferred embodiment: "Single Cuff Mode", "Dual CuffMode" and "IVRA Dual-Bladder Cuff Mode". Microprocessor 28 controls theoperation of instrument 2 in response to the level of the operating modesignal as described below. The level of the operating mode signal is setby microprocessor 28 retrieving a previously recorded level fromconfiguration register 56 and can be altered by the user by means ofswitch 22 as described below.

FIG. 3a shows the layout of display panel 20 for "Single Cuff Mode",wherein only cuff 4 is actuated and used in a surgical procedure. Asdepicted in FIG. 3a, a single display region 70 labeled MAIN CUFF isshown on display panel 20 and predetermined menu 72 is also displayedfor the user. Menu 72 enables choices to be made by the user for:temporarily silencing audio alarms; printing on event register printer62 the events recorded in event register memory 60; initiating thedetermination of recommended cuff pressure; selecting an operating mode,or obtaining operating instructions. Menu 72 is depicted in FIG. 3a withthe menu command "SELECT OPERATING MODE" shown in reverse video,indicating that it has been selected by the user of instrument 2. Asshown in FIG. 3a, within display region 70 labeled MAIN CUFF parametersand menu commands for controlling cuff 4 are displayed, and alldisplayed parameters are continually updated by microprocessor 28. Thedisplayed parameters are: the current level of cuff pressure, cuffpressure reference level, cuff inflation time and inflation time alarmlimit level. The menu commands for control of cuff 4 are: "inflate" and"deflate". If the user selects the command "inflate", instrument 2 willregulate the pressure in cuff 4 near the level of the cuff 4 referencepressure signal as described above. If the user selects the command"deflate" instrument 2 will release the pressure in cuff 4 causing cuff4 to deflate to atmospheric pressure. In "Single Cuff Mode" all alarmand event messages refer only to cuff 4.

FIG. 3b depicts the layout of display panel 20 for "Dual Cuff Mode",corresponding to the second of three predetermined levels of theoperating mode signal. In "Dual Cuff Mode" both cuff 4 and cuff 6 areactuated. As illustrated in FIG. 3b two independent display regions areshown on display panel 20, as well as the predetermined user menu 72described above. One region 70 is labeled MAIN CUFF, within which regionare displayed the parameters and menu commands for control of cuff 4.The second region 74 is labeled SECOND CUFF, within which region aredisplayed the parameters and controls for cuff 6. The parameters andcontrols displayed in region 74 are identical to those described abovefor cuff 4, except the parameters and controls displayed in region 74refer to cuff 6. In "Dual Cuff Mode", the inflation and deflation ofcuff 4 is independent of the inflation and deflation of cuff 6. Allalarm and event messages refer either to cuff 4, the MAIN CUFF or tocuff 6, the SECOND CUFF. When cuff 6 is inflated in the "Dual CuffMode", the operating mode signal cannot be changed by the user untilsuch time as cuff 6 has been deflated.

FIG. 3c depicts the layout of display panel 20 for the "IVRADual-Bladder Cuff Mode", corresponding to the third level of theoperating mode signal. This mode can only be selected by the user whenboth cuff 4 and cuff 6 are deflated. The "IVRA Dual-Bladder Cuff Mode"is the preferred mode for selection by the user when IntravenousRegional Anesthesia (IVRA) also known as Bier block anesthesia, isemployed. In "IVRA Dual-Bladder Cuff Mode" both cuff 4 and cuff 6 areactuated. As shown in FIG. 3c two independent display regions 76 and 78are shown on display panel 20, also shown is predetermined user menu 72having the structure and function as described above. Region 76, labeledPROXIMAL CUFF contains displays of parameters and controls for cuff 4.Region 78, labeled DISTAL CUFF contains displays of the parameters andcontrols for cuff 6. Alarm and event messages are generated to referseparately either to cuff 4, the PROXIMAL CUFF, or to cuff 6 the DISTALCUFF. When the preferred embodiment is operating in "IVRA Dual-BladderMode", the operating mode signal cannot be changed by the user whileeither cuff 4 or cuff 6 is inflated.

In "IVRA Dual-Bladder Cuff Mode" a safety interlock is activated toreduce the probability of unintended and inadvertent deflation of bothcuffs during a surgical procedure involving IVRA. The safety interlockoperates as follows: if the user initiates deflation of cuff 4 whilecuff 6 is deflated, or if the user initiates deflation of the cuff 6while cuff 4 is deflated, a safety interlock signal is produced toprevent the initiated deflation and a visual and audible warning isgiven via display panel 20 and speaker 68 to indicate to the user thatthe action the user has initiated may be unsafe, i.e. that the actionwould result in cuff 4 and cuff 6 being deflated at a time in a surgicalprocedure involving IVRA when liquid anesthetic agent contained in bloodvessels distal to cuff 4 and cuff 6 may be released into systemiccirculation. A menu command is displayed on display panel 20 forenabling the user to confirm that deflation of the cuff is intended. Tocontinue with the initiated deflation, the user must intentionallyconfirm that deflation of the cuff is intended by means of a distinctand discrete manipulation of switch 22 by the user; in the preferredembodiment this distinct confirmation action requires the user to rotateswitch 22 to select the confirmation menu command and then depressswitch 22 within a 5 sec time period, at which confirmation the cuff isdeflated. Alternatively if the user does not confirm the initiateddeflation through a discrete manipulation and actuation of switch 22within the 5 sec time period, then the initiated deflation is notcarried out and the menu command for enabling the user to confirm thatdeflation was intended is removed from display panel 20.

If the user has made an automatic determination of recommended cuffpressure for cuff 4 and cuff 6 as described below, the safety interlockalso operates as follows: if the user initiates deflation of cuff 4 orattempts to reduce the cuff 4 reference pressure to a level below thedetermined limb occlusion pressure for cuff 4 while the cuff 6 referencepressure or cuff 6 pressure is below the determined limb occlusionpressure for cuff 6 or attempts to deflate cuff 6 or reduce the cuff 6reference pressure to a level below the determined limb occlusionpressure for cuff 6 while the cuff 4 reference pressure or cuff 4pressure is below the determined limb occlusion pressure for cuff 4, asafety interlock signal is produced and a visual and audible warning isgiven via display panel 20 and speaker 68 to indicate to the user thatthe action the user has initiated may be unsafe, i.e. that the actionwould result in cuff 4 and cuff 6 being at a pressure which would allowblood flow at a time in a surgical procedure involving IVRA when liquidanesthetic agent contained in blood vessels distal to cuff 4 and cuff 6may be released into systemic circulation. A menu command is displayedon display panel 20 for enabling the user to confirm that deflation ofthe cuff or cuff reference pressure adjustment is intended. To continuewith the initiated deflation or cuff reference pressure adjustment, theuser must intentionally confirm that deflation or adjustment of the cuffreference pressure to a level below limb occlusion pressure is intendedby means of a distinct and discrete manipulation of switch 22 by theuser; in the preferred embodiment this confirmation requires the user torotate and then depress switch 22 within a 5 sec time period, at whichconfirmation deflation or the cuff reference pressure adjustment mayproceed. Alternatively if the user does not confirm the initiated cuffdeflation or cuff reference pressure adjustment through a discretemanipulation and actuation of switch 22 within the 5 sec time period,then the initiated deflation or adjustment is not carried out and themenu command for enabling the user to confirm that reduction of cuffpressure was intended is removed from display panel 20

In this manner, the safety interlock mechanism for IVRA detects apotentially unsafe action initiated by the operator's selection of acommand, produces a safety interlock signal and generates visual andaudible indications to warn the operator of the potentially unsafeaction which has been initiated, and prevents the initiated action frombeing implemented unless and until a distinct confirmation action isperformed by the operator. Although the preferred embodiment of thesafety interlock mechanism is described above, it will be appreciated bythose normally skilled in the art that alternate mechanisms andembodiments may be employed. For example, an alternate embodiment of thesafety interlock mechanism can be employed in any dual cuff tourniquetapparatus to detect any potentially unsafe attempt to deflate or reducethe pressure in one of the dual cuffs to a non-zero level, if the resultof that attempt to depressurize or reduce the pressure in the cuff maybe to allow the release of anesthetic agent past the cuff and intosystemic circulation when the dual cuff tourniquet apparatus is used inconjunction with IVRA. Also, an alternate embodiment of the safetyinterlock mechanism may employ only an audible warning, or only a visualwarning, or may generate no warning directly but may instead make thesafety interlock signal available for integration with other monitoringand display systems in the operating room. Further, an alternateembodiment of the safety interlock apparatus may employ other means forenabling the user to confirm that a potentially unsafe reduction of cuffpressure is intended; for example, a separate confirmation switch may beprovided for actuation by the user at any time after the detection ofthe potentially unsafe attempt, or confirmation may require thatmultiple actuations of the same switch be performed by the user within aspecified time period, or confirmation may require that two switches bedepressed simultaneously by the user.

To provide the user of instrument 2 with a detailed record of appliedpressures and alarm conditions, event register 58 is provided. "Events"which are defined in the software of the preferred embodiment to be: (a)actions by the user to inflate a cuff, deflate a cuff, adjust the levelof a cuff reference pressure signal, adjust the level of cuff inflationtime limit signal, adjust the level of the operating mode signal orsilence an audio alarm; (b) alarm events, resulting from microprocessor28 generating an alarm signal as described above; and (c) eventsassociated with determining a cuff pressure automatically as describedbelow. Microprocessor 28 communicates with event register 58 to recordevents as they occur. Microprocessor 28 records an event bycommunicating to event register 58: the time of the event as read fromreal time clock 52; a value identifying which one of a specified set ofevents occurred as determined by microprocessor 28; and the values atthe time of the event of the following parameters: operating modesignal, cuff 4 pressure signal; cuff 4 pressure reference signal; cuff 4inflation time, cuff 4 inflation time limit; cuff 6 pressure signal;cuff 6 pressure reference signal; cuff 6 inflation time, cuff 6inflation time limit; and recommended cuff pressure, when the eventoccurred. Entries are recorded in event register 58 by storing values inevent register memory 60 and by printing these values for the user bymeans of event register printer 62. In operation, the user can erasefrom the event register 58 previously registered events and prepareevent register 58 to retain new events.

The user, by means of selecting a menu command shown on display panel20, can cause descriptions of the events recorded in event registermemory 60 to be printed on event register printer 62. For each recordedevent, microprocessor 28 causes to be printed the time of the event, atext message describing the event, and the parameters recorded at thetime of the event.

In operation prior to the inflation of cuff 4 the user may instructmicroprocessor 28 by using switch 22 to select the "RECOMMEND CUFFPRESSURE" command on menu 72, thus beginning the automatic determinationof a recommended cuff pressure level for cuff 4. To determine arecommended cuff pressure microprocessor 28 first ensures that anadequate blood flow signal is being produced by sensor 10.Microprocessor 28 then sets to 50 mmHg the value of the cuff pressurereference signal for cuff 4 which causes the pressure in cuff 4 toincrease to 50 mmHg. Next, microprocessor 28 measures and stores thelevel of the blood flow signal being produced by sensor 10.Microprocessor 28 then increases, in discrete steps of 10 mmHg or 5 mmHgas described below, the value of the cuff 4 pressure reference signal upfrom 50 mmHg. If the level of the current blood flow signal from sensor10 is greater than or equal to 50 percent of the previously stored bloodflow signal level, microprocessor 28 increases the cuff 4 pressurereference signal in steps of 10 mmHg. If the level of the current bloodflow signal from sensor 10 is less than 50 percent of the previouslystored blood flow signal, microprocessor 28 increases the cuff 4pressure reference signal in steps of 5 mmHg. Microprocessor 28continues to increase the pressure reference signal for cuff 4, andthereby the pressure in cuff 4, until the pressure reference signal forcuff 4 exceeds 300 mmHg or the level of the current blood flow signalfrom sensor 10 is less than 3 percent of the previously stored bloodflow signal level. If the cuff 4 reference level exceeds 300 mmHg thedetermination of a recommended cuff pressure is terminated and the userof instrument 2 informed by messages displayed on display panel 20 thatthe determination was unsuccessful. The level of the pressure signalfrom cuff 4 corresponding to the lowest level at which the level of thecurrent blood flow signal from sensor 10 is less than 3 percent of thepreviously stored blood flow signal level is displayed as the LimbOcclusion Pressure and is used to calculate the Recommended CuffPressure, as follows. If the Limb Occlusion Pressure is less than orequal to 130 mmHg a safety margin of 40 mmHg is added to estimate theRecommended Cuff Pressure; if the Limb Occlusion Pressure is greaterthan 130 mmHg and no greater than 190 mmHg, a safety margin of 60 mmHgis added to estimate the Recommended Cuff Pressure; and if the LimbOcclusion Pressure is greater than 190 mmHg, a safety margin of 80 mmHgis added to estimate the Recommended Cuff Pressure. This RecommendedCuff Pressure level is displayed on display panel 20 and the cuffpressure reference signal is adjusted by microprocessor 28 to beequivalent to the level of the Recommended Cuff Pressure.

Additionally, prior to the inflation of cuff 6 when cuff 6 is used inaddition to cuff 4 for either "IVRA Dual Bladder Cuff Model" or "DualCuff Mode", the user may instruct microprocessor 28 by means of switch22 to automatically determine the Recommended Cuff Pressure level forcuff 6. The process for determining the Recommended Cuff Pressure forcuff 6 is the same as that described above for cuff 4.

III. Software

FIGS. 4, 5, 6, 7, 8 and 9 are software flow charts depicting thesequence of operations which microprocessor 28 is programmed to carryout in the preferred embodiment of the invention. In order to simplifythe discussion of the software, a detailed description of each softwaresubroutine and of the control signals which the software produces toactuate the hardware described above is not provided. It will however beunderstood by those skilled in the art that, for example, in order todisplay characters and graphics on display panel 20, microprocessor 28must generate appropriate signals and communicate them to displaycontroller 64. Functions or steps carried out by the software aredescribed below and related to the flow charts via parentheticalreference numerals in the text.

Software for the preferred embodiment was developed using the Cprogramming language and compiled with C96 (Intel Corp. Santa Clara,Calif.).

The main program software is depicted in FIGS. 4, 5, 6 and 7, and theutility software subroutines "read selector" and "regulate" are shown inFIGS. 8 and 9 respectively. FIG. 4 shows the initialization operationscarried out by the main program. FIG. 5 shows the operations taken toadjust and record user configuration parameters. FIG. 6 shows the mainprogram control loop entered at the completion of the initializationoperations. FIG. 7 shows the operation of the safety interlocksubroutine.

As shown in FIG. 4, the program commences (400) when power is suppliedto microprocessor 28 by initializing microprocessor 28 for operationwith the memory system and circuitry and hardware of the preferredembodiment. Display controller 64 is then initialized (402) with theparameters required for operation with display panel 20. Control is thenpassed to a self-test subroutine (404). The self-test subroutinedisplays a "SELF TEST IN PROGRESS" message on display panel 20 andperforms a series of diagnostic tests to ensure proper operation ofmicroprocessor 28 and its associated hardware. Should any diagnostictest fail (406), an error code is displayed on display panel 20 (408)and further operation of the system is halted (410); if no errors aredetected, control is returned to the main program.

As can be seen in FIG. 4, after the "self-test" has been completedsuccessfully, control is next passed to a subroutine (412) whichretrieves from configuration register 56 the levels of previouslyrecorded configuration parameters. The parameters are: a level for theoperating mode signal and, for each of the three possible levels of theoperating mode signal, a level for the cuff reference pressure and cuffinflation time alarm limit for each cuff. Upon completion, thissubroutine returns control to the main program. Control is next passedto a subroutine (414) which tests the retrieved configuration parametersfor validity by: (1) calculating a checksum for the retrieved levels ofthe parameters and comparing it to a checksum previously calculated andrecorded in configuration register 56; (2) testing each retrievedparameter level to ensure it is within pre-defined allowable limits. Ifany of the retrieved parameters are found to be invalid (416) an errormessage is displayed on display panel 20 (418), and configurationparameters are set to default levels defined in software (420). Controlis then returned to the main program, where the operating mode signal,the levels for the cuff reference pressures, and the alarm limits areset to the values of the previously recorded configuration parameters(422).

As shown in FIG. 4, the software subroutine "read selector" whichprocesses user input from switch 22 and sends characters to eventregister printer 62, is then scheduled to run every millisecond (424).This subroutine is initiated by the software timer interrupt system ofmicroprocessor 28 and communicates with the main program by means ofglobal variables. The flow chart for this subroutine is shown in detailin FIG. 8 and is discussed below. The software subroutine "regulate",for controlling the pneumatic system and inputting signals fromphotoplethysmographic blood flow sensor 10, is then scheduled to runevery 30 milliseconds (426). This subroutine is initiated by thesoftware timer interrupt system of microprocessor 28 and communicateswith the main program by means of global variables. The flow chart forthis subroutine is shown in detail in FIG. 9 and is discussed below. Theflow chart for the main program is continued in FIG. 5.

As shown in FIG. 5, the operation of the main program continues bypassing control to a subroutine (500) which displays on display panel 20basic operating instructions and menu commands which allow the usereither to choose a menu command to "CONTINUE" with the operation of thepreferred embodiment or to choose a menu command to "CONFIGURE" thepreferred embodiment. Control is then passed to a "process user input"subroutine (502) for processing user input, as follows: the subroutinecommunicates with the subroutine "read selector" via global variables,updates displayed menu choices and values of parameters in response tothe rotation and activation of switch 22; and passes control to othersubroutines or parts of the main program based on menu commands selectedby the user. The processing of user input by this subroutine continuesuntil the user selects either the "CONFIGURE" (504) or "CONTINUE" (506)menu commands. If the user selects the "CONTINUE" menu command controlreturns to the main program and continues as detailed in FIG. 6. If theuser chooses the "CONFIGURE" menu command, control is passed to asubroutine (508) which displays the levels of parameters retained inconfiguration register 56 and associated menu commands; these parametersand menu commands are depicted in display region 80 labeledCONFIGURATION MENU and menu 82 shown in FIG. 3d. Control is next passedto a subroutine (510) for processing user input similar to thesubroutine described above; this subroutine updates the displayedparameters and menu commands to indicate adjustments made by the user.The processing of user input continues until a menu command for exitingthe configuration menu is selected by the user (512), as shown in menu82 in FIG. 3d. As can be seen in FIG. 5, control is then passed to asubroutine (514) which calculates a checksum for the levels of theconfiguration parameters and records the levels of the configurationparameters along with their associated checksum in configurationregister 56. Control is then returned to the subroutine (500) fordisplaying basic operating instructions and "CONTINUE" and "CONFIGURE"menu commands, and operation continues as described above.

The flow chart depicted in FIG. 6 shows the main program control loopentered in response to the "CONTINUE" menu command being selected asdescribed above. As shown in FIG. 6 the main program then enters a loopwhich continues until electrical power required for the operation ofmicroprocessor 28 is interrupted.

As depicted in FIG. 6, control is first passed to a subroutine (600)which displays on display panel 20 menu commands for controlling theoperation of the preferred embodiment. These menu commands are shown ifFIG. 3a as menu 72, which enables choices to be made by the user for:temporarily silencing audio alarms; printing on event register printer62 the events recorded in event register memory 60; initiating thedetermination of recommended cuff pressure; selecting an operating mode,or obtaining operating instructions. Control is then returned to themain program.

Control is next passed to a subroutine (602) which displays on displaypanel 20 operating parameters and controls referring only to cuff 4. Theoperating parameters include the current level of cuff pressure, cuffpressure reference level, inflation time and inflation time alarm limit.The menu commands for control of cuff 4 comprise: menu commands for cuffinflation and cuff deflation. These operating parameters and controlsare depicted in display region 70 labeled MAIN CUFF shown in FIG. 3a.Upon completion of this subroutine control is returned to the mainprogram.

If the operating mode signal described above is set to "Dual Cuff Mode"(604), control is passed to a subroutine (606) which displays on displaypanel 20 the operating parameters and menu commands for controlling cuff6. The parameters and menu commands are identical to those describedabove for cuff 4. These operating parameters and controls are depictedin display region 74 labeled SECOND CUFF shown in FIG. 3a. Uponcompletion this subroutine returns control to the main program.

If the operating mode signal described above is set to "IVRA DualBladder Cuff Mode" (608) control is passed to a subroutine (610) whichdisplays on display panel 20 the operating parameters and menu commandsfor controlling cuff 6. Control is then passed to a subroutine (612)which identifies the controls and parameters for cuff 4 as referring tothe PROXIMAL CUFF and the controls and parameters for cuff 6 asreferring to the DISTAL. This is depicted in FIG. 3c by display region76 labeled PROXIMAL CUFF and display region 78 labeled DISTAL CUFF. Asshown in FIG. 6, control is next passed to a "safety interlock"subroutine (614) to reduce the probability of unintended and inadvertentdeflation of both cuff 4 and cuff 6 during a surgical procedureinvolving IVRA. The "safety interlock" subroutine functions as describedbelow and depicted in FIG. 7.

The safety interlock subroutine shown in FIG. 7 commences by testingwhether depressurization of cuff 4 to a potentially unsafe low pressurehas been initiated by the user (700), either by selecting a menu commandfor the deflation of cuff 4 and activating switch 22, or by selectingthe cuff 4 reference pressure and adjusting it to a pressure below alevel representing the minimum pressure which will stop blood flow andthe release of anesthetic agent past cuff 4; if so, the state of cuff 6is then tested (702) and if cuff 6 is deflated or pressurized below alevel representing the minimum pressure which will stop blood flow andthe release of anesthetic agent past cuff 6, a safety interlock signalis generated (704) which prevents the initiated deflation of cuff 4 orinitiated cuff 4 reference pressure adjustment from occurring in theabsence of user confirmation; otherwise the safety interlock signal isnot produced and cuff 4 deflation or reference pressure adjustmentproceeds (706). In the preferred embodiment, a cuff is defined to bedeflated if the cuff pressure is less than a level of 10 mmHg, and thelevel representing the minimum pressure which will stop blood flow andthe release of anesthetic agent past a cuff is set to be the Limbocclusion Pressure for that cuff determined automatically as describedabove. It will be appreciated by those normally skilled in the art thatalternate mechanisms and embodiments may be employed for determining andsetting the pressure levels used in testing the states of cuffs; forexample, the levels may be preset to other pressures, or the presetlevels may be adjustable by a user. After producing a safety interlocksignal (704) control is passed to a subroutine (708) for displaying awarning message on display panel 20 and generating an audio alarm tone.Control is next passed to a subroutine (710) which displays a menucommand for requiring the user to confirm that the deflation ordepressurization of cuff 4 below the level is intended while cuff 6 isdeflated or pressurized to the low level. The safety interlocksubroutine continues by testing whether depressurization of cuff 6 to apotentially unsafe low pressure has been initiated by the user (712),either by selecting a menu command for the deflation of cuff 6 andactivating switch 22, or by selecting the cuff 6 reference pressure andadjusting it to a pressure below a level representing the minimumpressure which will stop blood flow and the release of anesthetic agentpast cuff 6; if so, the state of cuff 4 is then tested (714) and if cuff4 is deflated or pressurized below a level representing the minimumpressure which will stop blood flow and the release of anesthetic agentpast cuff 4, a safety interlock signal is generated (716) which preventsthe initiated deflation of cuff 6 or initiated cuff 6 reference pressureadjustment from occurring in the absence of user confirmation; otherwisethe safety interlock signal is not produced and cuff 6 deflation orreference pressure adjustment proceeds (718). After producing a safetyinterlock signal (716) control is passed to a subroutine (720) fordisplaying a warning message on display panel 20 and generating an audioalarm tone. Control is next passed to a subroutine (722) which displaysa menu command for requiring the user to confirm that the deflation ordepressurization of cuff 6 below the level is intended while cuff 4 isdeflated or pressurized to the low level. As shown in FIG. 7 the safetyinterlock subroutine continues by testing (724) whether a menu commandfor confirming the potentially unsafe deflation or depressurization ofcuff 4 is currently displayed on display panel 20. If the menu commandhas been displayed for greater than 5 seconds (726), control is passedto a subroutine (728) for removing from display panel 20 and therebymaking unavailable to the user the menu command for confirming thedeflation or depressurization of cuff 4. If the menu command forconfirming the deflation or depressurization of cuff 4 is displayed, andis selected by the user and switch 22 is activated (730), control ispassed to a subroutine (732) for producing a confirmation signal whichwill permit the initiated deflation or depressurization of cuff 4 toproceed. The safety interlock subroutine continues by testing (734)whether a menu command for confirming the potentially unsafe deflationor depressurization of cuff 6 is currently displayed on display panel20. If the menu command has been displayed for greater than 5 seconds(736), control is passed to a subroutine (738) for removing from displaypanel 20 and thereby making unavailable to the user the menu command forconfirming the deflation or depressurization of cuff 6. If the menucommand for confirming the deflation or depressurization of cuff 6 isdisplayed, and is selec d by the user and switch 22 is activated (740),control is passed to a subroutine (742) for producing a confirmationsignal which will permit the initiated deflation or depressurization ofcuff 6 to proceed. Control is then returned to the main program depictedin FIG. 6.

Referring to the flowchart depicted in FIG. 6, it can be seen that ifthe operating mode signal is set to "Single Cuff Mode", only thecontrols and parameters referring to cuff 4 will be displayed andavailable to the user.

As can be seen in FIG. 6, after completion of specific operationsrelated to the specific level of the operating mode signal, control thenpasses to a "process user input" subroutine (616) for processing userinput, and this subroutine communicates with the subroutine "readselector" via global variables to update the currently displayed menucommands and parameters in response to the rotation and activation ofswitch 22. This subroutine may also pass control to other subroutines orparts of the main program based on menu commands selected by the user.Upon completion, this subroutine returns control to the main program.

As indicated in FIG. 6, if the user has initiated an event (618) byinflating a cuff, deflating a cuff, adjusting the level of a cuffreference pressure signal, adjusting the level of cuff inflation timelimit signal, adjusting the level of the operating mode signal orsilence an audio alarm; control is next passed to a subroutine (620)which records the event in event register 58. An event is recorded bycommunicating to event register 58: the time of the event as read fromreal time clock 52; a value identifying which one of a specified set ofevents occurred; and the values at the time of the event of thefollowing parameters: operating mode signal, cuff 4 pressure signal;cuff 4 pressure reference signal; cuff 4 inflation time, cuff 4inflation time limit; cuff 6 pressure signal; cuff 6 pressure referencesignal; cuff 6 inflation time, cuff 6 inflation time limit; andrecommended cuff pressure, when the event occurred. Control is thenreturned to the main program.

As shown in FIG. 6, control in the main program loop is next passed tosubroutine (622) which tests for alarm conditions. If an alarm conditionis present (624), such as cuff over-pressurization, cuffunder-pressurization, or exceeding an inflation time limit, control ispassed to a subroutine (626) which initiates the generation of an alarmtone and displays on display panel 20 pre-assigned text messagesindicating the cuff to which the alarm refers and the actual alarmcondition present. Control is next passed to a subroutine (628) whichrecords the alarm event in event register 58. An alarm event is recordedby communicating to event register 58: the time of the event as readfrom real time clock 52; a value identifying which one of a specifiedset of alarm events occurred; and the values at the time of the event ofthe following parameters: operating mode signal, cuff 4 pressure signal;cuff 4 pressure reference signal; cuff 4 inflation time, cuff 4inflation time limit; cuff 6 pressure signal; cuff 6 pressure referencesignal; cuff 6 inflation time, cuff 6 inflation time limit; andrecommended cuff pressure, when the event occurred. Control is thenreturned to the main program. If alarms conditions are not present atthe completion of the test for alarm conditions, control is passed to asubroutine (630) for clearing any previously displayed alarm messagesand deactivating, if active, the audio alarm. Control is then returnedto the main program.

If the user has, by means of selecting the appropriate menu command,enabled the printing of events (632), then control is next transferredto a subroutine (634) to format and send registered events to theprinter. This subroutine retrieves events from the event register 58,formats the retained event information as an ASCII text string suitablefor printing on event register printer 62 and signals the subroutine"read selector" which sends characters to the printer that a string isavailable be printed. Control is then returned to the main program.

Also as indicated in FIG. 6, if the user has initiated a determinationof recommended cuff pressure for cuff 4 or cuff 6 if alternativelyselected by the user (634), control is passed to a subroutine for doingso. This subroutine (636) controls the sequencing of cuff inflation anddeflation and performs the activities related to determining arecommended a cuff pressure as follows. If the user has selected adetermination for cuff 4, the blood flow signal from sensor 10 is firstanalyzed and shown on display panel 20. The value of the cuff pressurereference signal for cuff 4 is then set to 50 mmHg which causes thepressure in cuff 4 to increase to 50 mmHg. Next, the level of the bloodflow signal being produced by sensor 10 is stored. The cuff 4 pressurereference signal is then increased up from 50 mmHg in discrete steps of10 mmHg or 5 mmHg as follows. If the level of the current blood flowsignal from sensor 10 is greater than or equal to 50 percent of thepreviously stored blood flow signal level, the cuff 4 pressure referencesignal is increased in steps of 10 mmHg. If the level of the currentblood flow signal from sensor 10 is less than 50 percent of thepreviously stored blood flow signal, the cuff 4 pressure referencesignal is increased in steps of 5 mmHg. The pressure reference signalfor cuff 4, and thereby the pressure in cuff 4 continue to be increaseduntil the pressure reference signal for cuff 4 exceeds 300 mmHg or thelevel of the current blood flow signal from sensor 10 is less than 3percent of the previously stored blood flow signal level. If the cuff 4reference level exceeds 300 mmHg the determination of a recommended cuffpressure is terminated and the user of instrument 2 informed by messagesdisplayed on display panel 20 that the determination was unsuccessful.The level of the pressure signal from cuff 4 corresponding to the lowestlevel at which the level of the current blood flow signal from sensor 10is less than 3 percent of the previously stored blood flow signal levelis considered to represent the "Limb Occlusion Pressure" and is used tocalculate the Recommended Cuff Pressure, as follows. If the LimbOcclusion Pressure is less than or equal to 130 mmHg a safety margin of40 mmHg is added to estimate the Recommended Cuff Pressure; if the LimbOcclusion Pressure is greater than 130 mmHg and no grater than 190 mmHg,a safety margin of 60 mmHg is added to estimate the Recommended CuffPressure; and if the Limb Occlusion Pressure is greater than 190 mmHg, asafety margin of 80 mmHg is added to estimate the Recommended CuffPressure. This Recommended Cuff Pressure level is displayed on displaypanel 20 and the cuff pressure reference signal is adjusted bymicroprocessor 28 to be equivalent to the level of the Recommended CuffPressure. Alternatively, if the user has initiated a determination ofRecommended Cuff Pressure for cuff 6, the subroutine performs the samesteps as described above for cuff 4 except the cuff 6 pressure referenceand cuff 6 pressure signals are used.

Control is next passed to a subroutine (638) which records in eventregister 58 the results of the determination. A recommend cuff pressureevent is recorded by communicating to event register 58: the time of theevent as read from real time clock 52; a value identifying which one ofa specified set of events occurred; and the values at the time of theevent of the following parameters: operating mode signal, cuff 4pressure signal; cuff 4 pressure reference signal; cuff 4 inflationtime, cuff 4 inflation time limit; cuff 6 pressure signal; cuff 6pressure reference signal; cuff 6 inflation time, cuff 6 inflation timelimit; and recommended cuff pressure, when the event occurred. Controlis then returned to the main program.

As depicted in FIG. 6, the software includes provision for the user todelete all entries from event register 58. This might be desired by theuser, for example, at the completion a surgical procedure. If the userhas selected the appropriate menu command (640), control is passed to asubroutine (642) which deletes all entries in the event register.Control is then returned to the main program.

The main program shown in FIG. 6 continues by looping through the stepsdescribed above until such time as electrical power required for theoperation of the preferred embodiment is removed or an error in programexecution is detected and the program is halted by microprocessor 28.

The flow chart depicted in FIG. 8 refers to the subroutine "readselector". This subroutine is initiated by the software timer interruptsystem of microprocessor 28 and runs asynchronously with the mainprogram. The subroutine communicates with the main program throughglobal variables. Upon entry, the subroutine schedules itself to runagain in one millisecond (800). If an ASCII text string describing aregistered event is to be printed (802), the status of event registerprinter 62 is polled and, if event register printer 62 is ready (804), acharacter is sent to event register printer 62 (806).

As next shown in FIG. 8, the status of the push-button of switch 22 isthen polled to see if it is depressed (808): if it is, this communicatedto the main program (810). The current position of the selector portionof switch 22 is then polled (812) and, if the position of the selectorhas changed since the last time it was polled by this routine (814), thedirection (clockwise or counter clockwise rotation) and amount of changein position is communicated to the main program (816). The subroutinethen terminates, and restarts again one milliseconds after its lastinitiation.

The flow chart depicted in FIG. 9 refers to the subroutine "regulate".This subroutine controls the pneumatic system (pump 40, valve assemblies26 and 38) and pre-processes input from sensor 10. This subroutine isalso initiated by the software timer interrupt system of microprocessor28 and runs asynchronously with the main program. The subroutinecommunicates with the main program through global variables.

As shown in detail in FIG. 9, upon entry, subroutine "regulate"schedules itself to run again in 30 ms (900). Next (902), the level ofthe pressure signal from pressure transducer 46 is read to indicate thepressure in reservoir 34 and compared to a reservoir reference pressurelevel which is set at 100 mmHg above the greater of the cuff 4 and cuff6 reference pressure levels; if the pressure in the reservoir is remainsunder the reference level by more than 20 mmHg for 300 ms, pump 40 isactivated. If the pressure in the reservoir remains above the referencelevel by 20 mmHg for 300 ms, pump 40 is deactivated.

Also in subroutine "regulate" shown in FIG. 9, (904)the level of thepressure signal from pressure transducer 24 is read to indicate thepressure in cuff 4. This pressure is subtracted from the referencepressure for cuff 4, and the magnitude and polarity of the resultingdifference signal is used to control the selection and opening times ofvalves within valve assembly 26, thereby regulating the pressure in cuff4 at the reference level within ±1 mmHg. For example, if the pressure incuff 4 is lower than the reference pressure for cuff 4, microprocessor28 opens low flow valve 1002 to introduce a controlled flow of gas intocuff 4 until the pressure in cuff 4 is within ±1 mmHg of the referencepressure. Similarly, excess pressure in cuff 14 would be exhausted byopening low flow valve 1006 until the pressure in cuff 4 is within thedesired pressure range, as indicated by a pressure signal fromtransducer 24. The low flow valves 1002, 1006 permit more precise andcontrolled alteration of the pressure in cuff 4 than is permitted byhigher flow valve 1004, 1010.

Also (906), the level of the pressure signal from pressure transducer 36is read to indicate the pressure in cuff 6, if pressurized. Thispressure is subtracted from the reference pressure for cuff 6, and themagnitude and polarity of the resulting difference signal is used tocontrol the selection and opening times of valves within valve assembly38, thereby regulating the pressure in cuff 6 at the reference levelwithin ±1 mmHg. Finally in subroutine "regulate", if a determination ofrecommended cuff pressure is in progress (908), the level of the bloodflow signal from sensor 10 is read and processed (910). The amplitude ofthis blood flow signal is determined and communicated to the mainprogram.

It is to be understood that the invention is not to be limited to thedetails herein given but may be modified within the scope of theappended claims.

We claim:
 1. An electrically operated physiologic tourniquet system,comprising:a pressurizing cuff for encircling and applying pressure to alimb; selector means for permitting an operator to select an initialreference pressure level; configuration register means for enabling theoperator to record in a memory the selected initial reference pressurelevel, wherein the memory retains the recorded initial referencepressure level irrespective of whether the power to the system isinterrupted; the configuration register means including selector readmeans for periodically determining whether the operator has changed theinitial reference pressure level; and regulator means for retrievingfrom the memory at the beginning of each use of the system the lastrecorded initial reference pressure level, and for regulating thepressure in the cuff to be near the retrieved initial reference pressurelevel, the regulator means including recommended cuff pressure means fordetermining the minimum pressure applied by the cuff to the limb thatprevents blood flow past the cuff, and for determining as a function ofthe minimum pressure a recommended cuff pressure to be applied by thecuff, and for enabling the operator to record the recommended cuffpressure in memory as the initial reference pressure level.
 2. Thesystem of claim 1 further comprising timing means for retrieving frommemory at the beginning of each use of the system an initial time limitduring which the cut should be applied;the selector means permitting anoperator to change the initial time limit; and the configurationregister means detecting changes to the initial time limit andpermitting the operator to record in the memory the changed time limitas the initial time limit, wherein the memory retains the initial timelimit irrespective of whether power to the system is interrupted.
 3. Thesystem of claim 1 wherein the selector means includes operator interfacemeans for displaying to an operator menu selections from which theoperator may select the initial reference pressure level.
 4. The systemof claim 2 wherein the selector means includes operator interface meansfor displaying to an operator menu selections from which the operatormay select the initial time limit.
 5. An electrically operatedphysiologic tourniquet system, comprising:an inflatable and deflatablecuff; selector means for displaying to an operator selections of initialtime limits and for permitting the operator to select one of thedisplayed initial time limits and to change the selected one of theinitial time limits; configuration register means for enabling anoperator to record in a memory the selected initial time limit and forperiodically determining whether the operator has changed the selectedinitial time limit, wherein the memory retains the last recorded initialtime limit irrespective of whether power to the system is interrupted;and timing means for retrieving from the memory at the beginning of eachuse of the system the last recorded initial time limit, for monitoring atime period, and for alerting the operator when the time period equalsthe time limit.
 6. The system of claim 5 including:control means forestablishing and monitoring the values of a plurality of systemoperating parameters; and event register means for recording in thememory the values of the parameters.
 7. The system of claim 5including:control means for establishing and monitoring the values of aplurality of system operating parameters; and event register means forproviding a readable record of the values of the parameters.
 8. Thesystem of claim 1 wherein the initial reference pressure level selectedby the operator is a pressure estimated by the operator to be sufficientto stop blood flow past the cuff.
 9. The system of claim 1 wherein theselector means includes operator interface means for enabling theoperator to select any one of a predetermined number of initialreference pressure levels and for enabling the operator to generate arecord signal, and wherein the configuration register means responds tothe record signal by recording in memory the selected initial referencepressure level.
 10. A physiologic tourniquet system comprising:aninflatable and deflatable cuff for encircling and applying pressure to alimb; at least one pressure source selectably pneumatically connected tothe cuff; at least one exhaust line selectably connected to the cuff; amicroprocessor that determines when to inflate the cuff, deflate thecuff, or regulate the pressure in the cuff, and that produces a cuffmode signal having one of a plurality of predefined signals indicativeof whether to inflate, deflate or regulate the pressure in the cuff; afirst inlet valve responsive to a first inlet valve actuation signal anda first inlet valve deactuation signal from the microprocessor, whereinthe first inlet valve is opened by the first inlet valve actuationsignal to pneumatically connect the pressure source to the cuff, ordeactuated by the first inlet valve deactuation signal to close thepneumatic connection between the cuff and pressure source; a first inletvalve status output signal from the first inlet valve to indicatewhether the first inlet valve is actuated or deactuated; and a safetycircuit that monitors the cuff mode signal and the first inlet valvestatus output signal for undesired combinations of cuff mode signal andfirst inlet valve status output signal and produces a fault signal if anundesired combination is detected.
 11. The apparatus of claim 10 whereinproduction of the fault signal prevents actuation of the first inletvalve.
 12. The apparatus of claim 10 further comprising:a second inletvalve responsive to a second inlet valve actuation signal and a secondinlet valve deactuation signal from the microprocessor, wherein thesecond inlet valve is opened by the second inlet valve actuation signalto pneumatically connect the pressure source to the cuff, or closed bythe second inlet valve deactuation signal; a second inlet valve statusoutput signal from the second inlet valve to indicate whether the secondinlet valve is actuated or deactuated; and wherein the safety circuitfurther monitors the second inlet valve status output signal forundesired combinations of cuff mode signal and first and second inletvalve status output signals and produces a fault signal if an undesiredcombination is detected.
 13. A physiologic tourniquet systemcomprising:an inflatable and deflatable cuff for encircling and applyingpressure to a limb; at least one pressure source selectablypneumatically connected to the cuff; at least one exhaust lineselectably connected to the cuff; a microprocessor that determines whento inflate the cuff, deflate the cuff, or regulate the pressure in thecuff, and that produces a cuff mode signal having one of a plurality ofpredefined signals indicative of whether to inflate, deflate or regulatethe pressure in the cuff; a first exhaust valve responsive to a firstexhaust valve actuation signal and a first exhaust valve deactuationsignal from the microprocessor, wherein the first exhaust valve isopened by the first exhaust valve actuation signal to pneumaticallyconnect the cuff to the exhaust line, or deactuated by the first exhaustvalve deactuation signal to close the pneumatic connection between thecuff and the exhaust line; a first exhaust valve status output signalfrom the first exhaust valve to indicate whether the first exhaust valveis actuated or deactuated; and a safety circuit that monitors the cuffmode signal and the first exhaust valve status output signal forundesired combinations of cuff mode signal and first exhaust valvestatus output signal and produces a fault signal if an undesiredcombination is detected.
 14. The apparatus of claim 13 furthercomprising:a second exhaust valve responsive to a second exhaust valveactuation signal and a second exhaust valve deactuation signal from themicroprocessor, wherein the second exhaust valve is opened by the secondexhaust valve actuation signal to pneumatically connect the cuff to theexhaust line, or deactuated by the second exhaust valve deactuationsignal to close the pneumatic connection between the cuff and theexhaust line; a second exhaust valve status output signal from thesecond exhaust valve to indicate whether the second exhaust valve isactuated or deactuated; and wherein the safety circuit further monitorsthe second exhaust valve status output signal for undesired combinationsof cuff mode signal and first and second exhaust valve status outputsignals and produces a fault signal if an undesired combination isdetected.
 15. The apparatus of claim 12 further comprising:a firstexhaust valve responsive to a first exhaust valve actuation signal and afirst exhaust valve deactuation signal from the microprocessor, whereinthe first exhaust valve is opened by the first exhaust valve actuationsignal to pneumatically connect the cuff to the exhaust line, ordeactuated by the first exhaust valve deactuation signal to close thepneumatic connection between the cuff and the exhaust line; a firstexhaust valve status output signal from the first exhaust valve toindicate whether the first exhaust valve is actuated or deactuated; asecond exhaust valve responsive to a second exhaust valve actuationsignal and a second exhaust valve deactuation signal from themicroprocessor, wherein the second exhaust valve is opened by the secondexhaust valve actuation signal to pneumatically connect the cuff to theexhaust line, or deactuated by the second exhaust valve deactuationsignal; a second exhaust valve status output signal from the secondexhaust valve to indicate whether the second exhaust valve is actuatedor deactuated; and wherein the safety circuit further monitors the firstand second exhaust valve status output signals for undesiredcombinations of cuff mode signal and first and second exhaust and inletvalve status output signals and produces a fault signal if an undesiredcombination is detected.
 16. The apparatus of claim 15 wherein thesafety circuit produces the fault signal:when the cuff is in a cuffinflating mode and is connected to the exhaust line or disconnected fromthe pressure source; or when the cuff is in a cuff deflating mode and isconnected to the pressure source or disconnected from the exhaust line;or when the cuff is in a regulating mode and is simultaneously connectedto both the pressure source and the exhaust line.
 17. The apparatus ofclaim 16 wherein production of the fault signal prevents actuation ofany of the first or second exhaust or inlet valves.
 18. A physiologictourniquet system, comprising:an inflatable and deflatable cuff; amicroprocessor that determines when to inflate the cuff, deflate thecuff, or regulate the pressure in the cuff, and that produces a cuffmode signal having one of a plurality of predefined levels indicative ofwhether to inflate, deflate or regulate the pressure in the cuff; aregulator responsive to the cuff mode signal for inflating the cuff,deflating the cuff and regulating the pressure in the cuff; and a safetycircuit operable independently of the microprocessor and responsive tothe cuff mode signal and having a plurality of stored levels for thecuff mode signal, wherein the safety circuit operates by comparing thelevel of the cuff mode signal to the plurality of levels for the cuffmode signal and produces a microprocessor fault signal when the cuffmode signal level does not correspond to one of the sets of storedlevels.
 19. An electrically operated physiologic tourniquet system,comprising:an inflatable and deflatable cuff for encircling and applyingpressure to a limb; a pressure source for supplying pressurized gas tothe cuff; first and second valves through which the pressure source isindependently connected to the cuff; regulator means for producing acuff mode signal and first and second inlet valve actuation signals; andwherein the pressure source is selectively pneumatically connected tothe cuff through actuation of the first or second valves by theregulator means, and a safety circuit senses preset undesiredcombinations of the cuff mode signal and actuation of the first andsecond valves, and produces a fault signal in response to detection ofany of the undesired combinations; and wherein the cuff is connected toan exhaust line through actuation of separate third or fourth valves bythe regulator means, and the safety circuit senses preset undesiredcombinations of the cuff mode signal and actuation of the third andfourth valves, and produces the fault signal in response to detection ofany of the undesired combinations of the cuff mode signal and actuationof the third and fourth valves.